fixing Snort2Lua csv output

diff --git a/src/loggers/alert_csv.cc b/src/loggers/alert_csv.cc
index de8fa1bff387d5ff9f92b4cf7e6c3d01d120f751..ec49afab832d9651df3117ef75399adf63daf6c2 100644 (file)
--- a/src/loggers/alert_csv.cc
+++ b/src/loggers/alert_csv.cc
@@ -65,7 +65,7 @@ using namespace std;
     "src_addr | dst_addr | src_port | dst_port | " \
     "eth_src | eth_dst | eth_type | eth_len | " \
     "ttl | tos | id | ip_len | dgm_len | " \
-    "icmp_type | icmp_code | icmp_id | icmp_seq" \
+    "icmp_type | icmp_code | icmp_id | icmp_seq | " \
     "tcp_flags | tcp_seq | tcp_ack | tcp_len | tcp_win | " \
     "udp_len"
 

diff --git a/src/parser/keywords.h b/src/parser/keywords.h
index 548cbe6730ff5d43fa761e8e61b2cefd64717282..3d5f7edf4ecffc42f512013a1d841c08e82ebfc5 100644 (file)
--- a/src/parser/keywords.h
+++ b/src/parser/keywords.h
@@ -48,4 +48,3 @@
 #define CHECKSUM_MODE_OPT__NO_ICMP  "noicmp"
 
 #endif
-

diff --git a/src/stream/tcp/ips_stream_reassemble.cc b/src/stream/tcp/ips_stream_reassemble.cc
index 75d2b85184284f505f45bcbed77d00f8d42bed22..d493abe261f5c98bcaa4049a438a37ff0bae77c9 100644 (file)
--- a/src/stream/tcp/ips_stream_reassemble.cc
+++ b/src/stream/tcp/ips_stream_reassemble.cc
@@ -157,10 +157,10 @@ int ReassembleOption::eval(Cursor&, Packet* pkt)
 
 static const Parameter s_params[] =
 {
-    { "*action", Parameter::PT_ENUM, "disable|enable", nullptr,
+    { "action", Parameter::PT_ENUM, "disable|enable", nullptr,
       "stop or start stream reassembly" },
 
-    { "*direction", Parameter::PT_ENUM, "client|server|both", nullptr,
+    { "direction", Parameter::PT_ENUM, "client|server|both", nullptr,
       "action applies to the given direction(s)" },
 
     { "noalert", Parameter::PT_IMPLIED, nullptr, nullptr,
@@ -197,10 +197,10 @@ bool ReassembleModule::begin(const char*, int, SnortConfig*)
 
 bool ReassembleModule::set(const char*, Value& v, SnortConfig*)
 {
-    if ( v.is("*action") )
+    if ( v.is("action") )
         srod.enable = v.get_long();
 
-    else if ( v.is("*direction") )
+    else if ( v.is("direction") )
         srod.enable = v.get_long() + 1;
 
     else if ( v.is("noalert") )

diff --git a/src/stream/tcp/ips_stream_size.cc b/src/stream/tcp/ips_stream_size.cc
index 395798a655d2c2be97e78f4fcad1a2027d5db550..c746ded0f943c77c54dc698afc6141848d74ecc5 100644 (file)
--- a/src/stream/tcp/ips_stream_size.cc
+++ b/src/stream/tcp/ips_stream_size.cc
@@ -220,13 +220,13 @@ int SizeOption::eval(Cursor&, Packet* pkt)
 
 static const Parameter s_params[] =
 {
-    { "*direction", Parameter::PT_ENUM, "either|client|server|both", nullptr,
+    { "direction", Parameter::PT_ENUM, "either|client|server|both", nullptr,
       "compare applies to the given direction(s)" },
 
-    { "*operator", Parameter::PT_ENUM, "= | != | < | > | <= | >=", nullptr,
+    { "operator", Parameter::PT_ENUM, "= | != | < | > | <= | >=", nullptr,
       "how to compare" },
 
-    { "*size", Parameter::PT_INT, nullptr, nullptr,
+    { "size", Parameter::PT_INT, nullptr, nullptr,
       "size for comparison" },
 
     { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }

diff --git a/tools/snort2lua/config_states/config_checksums.cc b/tools/snort2lua/config_states/config_checksums.cc
index e39e801d57025dfe73f6a47579e1905e4c46f04f..422c2722d424ed6f0d1e115fe106f10d3cf6925f 100644 (file)
--- a/tools/snort2lua/config_states/config_checksums.cc
+++ b/tools/snort2lua/config_states/config_checksums.cc
@@ -53,18 +53,14 @@ public:
         if (snort_option == nullptr || lua_table == nullptr)
             return false;
 
-
         table_api.open_table(*lua_table);
 
 
         if(lua_option == nullptr)
-        {
             lua_option = snort_option;
-        }
         else if (snort_option->compare(*lua_option))
-        {
             table_api.add_diff_option_comment(*snort_option, *lua_option);
-        }
+
 
         while (stream >> val)
             retval = table_api.add_list(*lua_option, val) && retval;

diff --git a/tools/snort2lua/output_states/out_csv.cc b/tools/snort2lua/output_states/out_csv.cc
index ceaa2cd7aaadc331ff732955c3ea605bce3abac9..55f9fc31db0b3d656b9784152e2aab4e8b235517 100644 (file)
--- a/tools/snort2lua/output_states/out_csv.cc
+++ b/tools/snort2lua/output_states/out_csv.cc
@@ -61,7 +61,6 @@ bool AlertCsv::convert(std::istringstream& data_stream)
     if (!(data_stream >> keyword))
         return retval;
 
-
     // parsing the format list.
     std::istringstream format(keyword);
     while (std::getline(format, val, ','))
@@ -80,12 +79,6 @@ bool AlertCsv::convert(std::istringstream& data_stream)
         else if (!val.compare("proto"))
             tmpval = table_api.add_list("csv", "proto");
 
-        else if (!val.compare("dst"))
-            tmpval = table_api.add_list("csv", "dst");
-
-        else if (!val.compare("src"))
-            tmpval = table_api.add_list("csv", "src");
-
         else if (!val.compare("ttl"))
             tmpval = table_api.add_list("csv", "ttl");
 
@@ -95,15 +88,30 @@ bool AlertCsv::convert(std::istringstream& data_stream)
         else if (!val.compare("tos"))
             tmpval = table_api.add_list("csv", "tos");
 
+        else if (!val.compare("trheader"))
+            tmpval = table_api.add_deleted_comment("trheader");
+
+        else if (!val.compare("dst"))
+        {
+            table_api.add_diff_option_comment("dst", "dst_addr");
+            tmpval = table_api.add_list("csv", "dst_addr");
+        }
+
+        else if (!val.compare("src"))
+        {
+            table_api.add_diff_option_comment("src", "src_addr");
+            tmpval = table_api.add_list("csv", "src_addr");
+        }
+
         else if (!val.compare("sig_generator"))
         {
             table_api.add_diff_option_comment("sig_generator", "gid");
             tmpval = table_api.add_list("csv", "gid");
         }
 
-        else if (!val.compare("sid_id"))
+        else if (!val.compare("sig_id"))
         {
-            table_api.add_diff_option_comment("sid_id", "sid");
+            table_api.add_diff_option_comment("sig_id", "sid");
             tmpval = table_api.add_list("csv", "sid");
         }
 
@@ -143,6 +151,13 @@ bool AlertCsv::convert(std::istringstream& data_stream)
             tmpval = table_api.add_list("csv", "eth_len");
         }
 
+        else if (!val.compare("ethtype"))
+        {
+            table_api.add_diff_option_comment("ethtype", "eth_type");
+            tmpval = table_api.add_list("csv", "eth_type");
+        }
+
+
         else if (!val.compare("tcpflags"))
         {
             table_api.add_diff_option_comment("tcpflags", "tcp_flags");
@@ -209,6 +224,12 @@ bool AlertCsv::convert(std::istringstream& data_stream)
             tmpval = table_api.add_list("csv", "icmp_seq");
         }
 
+        else if (!val.compare("udplength"))
+        {
+            table_api.add_diff_option_comment("udplength", "udp_len");
+            tmpval = table_api.add_list("csv", "udp_len");
+        }
+
         else
         {
             tmpval = false;

diff --git a/tools/snort2lua/rule_states/CMakeLists.txt b/tools/snort2lua/rule_states/CMakeLists.txt
index ae3b0ac53b84eefcac49b9ac004aeea26b0f0a74..6cab9f1866186af9b1d107816a528b77b641a613 100644 (file)
--- a/tools/snort2lua/rule_states/CMakeLists.txt
+++ b/tools/snort2lua/rule_states/CMakeLists.txt
@@ -9,6 +9,7 @@ add_library( rule_states
     rule_pcre.cc
     rule_react.cc
     rule_resp.cc
+    rule_stream_reassemble.cc
     rule_tag.cc
     rule_threshold.cc
     rule_unchanged.cc

diff --git a/tools/snort2lua/rule_states/Makefile.am b/tools/snort2lua/rule_states/Makefile.am
index 0a578340e66e2cc7ae8739235c679cf9af5f741c..da30f5b1593dd96bcd8a36e490081a20068a359b 100644 (file)
--- a/tools/snort2lua/rule_states/Makefile.am
+++ b/tools/snort2lua/rule_states/Makefile.am
@@ -13,6 +13,7 @@ rule_metadata.cc \
 rule_pcre.cc \
 rule_react.cc \
 rule_resp.cc \
+rule_stream_reassemble.cc \
 rule_tag.cc \
 rule_threshold.cc \
 rule_unchanged.cc \

diff --git a/tools/snort2lua/rule_states/rule_tag.cc b/tools/snort2lua/rule_states/rule_tag.cc
index 04397de4690b8ab4e0761a75b6602eaee48fbf20..38ea05b4ec052cb0c1aa5ec5a74128bbfd9c8700 100644 (file)
--- a/tools/snort2lua/rule_states/rule_tag.cc
+++ b/tools/snort2lua/rule_states/rule_tag.cc
@@ -116,7 +116,6 @@ bool Tag::convert(std::istringstream& data_stream)
                 else
                     rule_api.bad_rule(data_stream, "tag:<type> " + value + " - unknown metric");
             }
-
             cnt = !cnt;
         }
 

diff --git a/tools/snort2lua/rule_states/rule_threshold.cc b/tools/snort2lua/rule_states/rule_threshold.cc
index 0836494cd4246c2603259689a14e4068448028e4..64470ec6f447366e3d40aa92c2821d7f4c3d4057 100644 (file)
--- a/tools/snort2lua/rule_states/rule_threshold.cc
+++ b/tools/snort2lua/rule_states/rule_threshold.cc
@@ -136,6 +136,9 @@ bool Threshold::convert(std::istringstream& data_stream)
         tmp_pos = data_stream.tellg();
     }
 
+    if (!found_gid)
+        table_api.add_option("gid", 1);
+
 
     table_api.close_table();
     table_api.close_table();

diff --git a/tools/snort2lua/rule_states/rule_unchanged.cc b/tools/snort2lua/rule_states/rule_unchanged.cc
index c246c11380a5aabfd944af1ade79b61fd9cb17e2..3bfabb6f6d44d797c54ded93984d0d9d9366ec7a 100644 (file)
--- a/tools/snort2lua/rule_states/rule_unchanged.cc
+++ b/tools/snort2lua/rule_states/rule_unchanged.cc
@@ -415,19 +415,6 @@ static const ConvertMap rule_sameip =
 
 const ConvertMap* sameip_map = &rule_sameip;
 
-/************************************
- ******  STREAM_RESSAMBLE  **********
- ************************************/
-
-static const std::string stream_reassemble = "stream_reassemble";
-static const ConvertMap rule_stream_reassemble =
-{
-    stream_reassemble,
-    unchanged_rule_ctor<&stream_reassemble>,
-};
-
-const ConvertMap* stream_reassemble_map = &rule_stream_reassemble;
-
 /************************************
  *********  STREAM_SIZE  ************
  ************************************/

diff --git a/tools/snort2lua/tests/snort.conf.in b/tools/snort2lua/tests/snort.conf.in
index d9224c0adb1dd65ab77eddbace79a5d06513e9c7..15f256b8f05d0b447b0d3f550e4f04a7f04c97fa 100644 (file)
--- a/tools/snort2lua/tests/snort.conf.in
+++ b/tools/snort2lua/tests/snort.conf.in
@@ -931,7 +931,7 @@ output alert_unixsock:
 output alert_csv:
 output alert_csv: @CMAKE_CURRENT_BINARY_DIR@/alert_csv1.dlt
 output alert_csv: @CMAKE_CURRENT_BINARY_DIR@/alert_csv2.dlt default
-output alert_csv: @CMAKE_CURRENT_BINARY_DIR@/alert_csv3.dlt timestamp,sig_generator,sid_id,sig_rev,msg,proto,src,srcport,dst,dstport,ethsrc,ethdst,ethlen,tcpflags,tcpseq,tcpack,tcplen,tcpwindow,ttl,tos,id,dgmlen,iplen,icmptype,icmpcode,icmpid,icmpseq  63
+output alert_csv: @CMAKE_CURRENT_BINARY_DIR@/alert_csv3.dlt timestamp,sig_generator,sig_id,sig_rev,msg,proto,src,srcport,dst,dstport,ethsrc,ethdst,ethlen,tcpflags,tcpseq,tcpack,tcplen,tcpwindow,ttl,tos,id,dgmlen,iplen,icmptype,icmpcode,icmpid,icmpseq,ethtype,udplength  63
 output alert_csv: @CMAKE_CURRENT_BINARY_DIR@/alert_csv4.dlt default,icmptype,icmpcode,icmpid 64K
 output alert_csv: @CMAKE_CURRENT_BINARY_DIR@/alert_csv5.dlt default,icmptype,icmpcode,icmpid 65M
 output alert_csv: @CMAKE_CURRENT_BINARY_DIR@/alert_csv6.dlt default,icmptype,icmpcode,icmpid 66G
@@ -1289,4 +1289,8 @@ alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"INDICATOR-COMPROMISE
 alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-OTHER NeoSploit Malvertising - URI Requested"; flow:to_server,established; urilen:>62; content:"GET /?"; fast_pattern:only; pcre:"/\/\?[0-9a-f]{60,66}[\;\d]*$/U"; metadata:policy balanced-ips drop, policy security-ips drop, service http; classtype:trojan-activity; sid:23058; rev:2;)
 alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"EXPLOIT-KIT Redkit exploit kit landing page"; flow:to_server,established; urilen:18<>21; content:".html?h="; fast_pattern:only; http_uri; pcre:"/\/[a-z]{4}\.html\?h\=\d{6,7}$/Ui"; metadata:policy balanced-ips drop, policy security-ips drop, service http; reference:cve,2012-0188; reference:cve,2012-0507; reference:cve,2012-1723; reference:cve,2012-4681; reference:cve,2013-0422; reference:cve,2013-2423; reference:url,blog.malwarebytes.org/intelligence/2013/04/redkit-exploit-kit-does-the-splits/; classtype:trojan-activity; sid:26345; rev:3;)
 alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"EXPLOIT-KIT Blackholev2 exploit kit Initial Gate from Linked-In Mailing Campaign"; flow:to_server,established; urilen:17,norm; content:"/linkendorse.html"; fast_pattern:only; http_uri; metadata:policy balanced-ips drop, policy security-ips drop, ruleset community, service http; classtype:trojan-activity; sid:26814; rev:1;)
-alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"EXPLOIT-KIT Blackholev2 exploit kit Initial Gate from Linked-In Mailing Campaign"; flow:to_server,established; urilen:17,raw; content:"/linkendorse.html"; fast_pattern:only; http_uri; metadata:policy balanced-ips drop, policy security-ips drop, ruleset community, service http; classtype:trojan-activity; sid:26814; rev:1;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"EXPLOIT-KIT Blackholev2 exploit kit Initial Gate from Linked-In Mailing Campaign"; flow:to_server,established; urilen:17,raw; content:"/linkendorse.html"; fast_pattern:only; http_uri; metadata:policy balanced-ips drop, policy security-ips drop, ruleset community, service http; classtype:trojan-activity; sid:26815; rev:1;)
+
+alert tcp any any -> any any ( sid:26816; msg:"tunnel"; flow:established; content:"250-localhost"; stream_reassemble:disable,both,fastpath; )
+alert tcp any any -> any any ( sid:26817; msg:"tunnel"; flow:established; content:"250-localhost"; stream_reassemble:enable,client,fastpath,noalert; )
+alert tcp any any -> any any ( sid:26818; msg:"tunnel"; flow:established; content:"250-localhost"; stream_reassemble:enable,server,fastpath,noalert; )